PT-2023-14612 · Wellintech · Kinghistorian

Carl Hurd · Published 2023-03-20 · Updated 2023-07-07 · CVE-2022-45124

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions WellinTech KingHistorian version 35.01.00.05

Description An information disclosure issue exists in the User authentication functionality. A specially crafted network packet can lead to a disclosure of sensitive information. An attacker can sniff network traffic to leverage this issue.

Recommendations For WellinTech KingHistorian version 35.01.00.05, consider restricting access to the network to minimize the risk of exploitation until a patch is available. As a temporary workaround, limit the use of the User authentication functionality to reduce the risk of sensitive information disclosure. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Improper Authentication

Information Disclosure

Weakness Enumeration

CWE-287

CWE-200

Related Identifiers

CVE-2022-45124

Affected Products

Kinghistorian

References · 6

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2022-1683 · Exploit
• https://osv.dev/vulnerability/CVE-2022-45124 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-45124 · Security Note
• https://t.me/cibsecurity/60353 · Telegram Post
• https://t.me/cvenotify/46542 · Telegram Post
• https://t.me/true_secator/4203 · Telegram Post